MAL-2026-13913 Malicious code in @years20/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df The package presents as an n8n community-nodes helper but ships a malicious postinstall script callback.js and a byte-identical main entrypoint...

MAL-2026-13907 Malicious code in @years19/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4 The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm...

Malicious code in @years19/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4 The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm...

Malicious code in @years20/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8 The package runs a hostile payload both from its declared postinstall hook node callback.js and at library load via index.js, which is byte-identical...

MAL-2026-13912 Malicious code in @years20/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8 The package runs a hostile payload both from its declared postinstall hook node callback.js and at library load via index.js, which is byte-identical...

Malicious code in @years19/n8n-nodes-utils-helper-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f5f361848c187cd60f9143d0bdc5d2db20a3e2fa03fe5e494697da05c4a42a The package advertises itself as an n8n community utility helper node package.json declares n8n.nodes: "nodes/PwnNode.node.js" with description...

MAL-2026-13908 Malicious code in @years19/n8n-nodes-utils-helper-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f5f361848c187cd60f9143d0bdc5d2db20a3e2fa03fe5e494697da05c4a42a The package advertises itself as an n8n community utility helper node package.json declares n8n.nodes: "nodes/PwnNode.node.js" with description...

Malicious code in @years19/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5 The package's postinstall entry callback.js and its declared main entry index.js contain byte-identical top-level code that 1 writes a Python UDP/TCP...

MAL-2026-13906 Malicious code in @years19/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5 The package's postinstall entry callback.js and its declared main entry index.js contain byte-identical top-level code that 1 writes a Python UDP/TCP...

Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

de4py v3.3.2-stable

de4py ⚠️ de4py is FREE & OPEN SOURCE CC BY-NC 4.0. Any paid versions sold elsewhere or commercial use are NOT permitted. If you paid for de4py, you were misled. De4py is an advanced Python deobfuscator with a beautiful UI PySide6 and a robust set of features for malware analysts and reverse...

Malicious code in verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b package.json declares preinstall: node index.js, which runs automatically on npm install. index.js shells out via childprocess and curl to POST the...

fibratus v3.1.0

Fibratus Security sensor for realtime threat detection and protection Get Started » Docs • Rules • Filaments • Download • Discussions Fibratus detects and eradicates advanced attacker tradecraft, malware, and emerging threats by scrutinizing and asserting a wide spectrum of system events against ...

Malicious code in @years17/n8n-nodes-helper-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64819454fc9d9904917336a6e36102f0925718ad2f4eab2d6673d75ff68fe777 Package ships a malicious n8n community node with three independent installer-harm paths. 1 package.json declares a postinstall script that shells ou...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

Malicious code in @years17/n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2 The package's postinstall script also executed on require via index.js runs a series of host reconnaissance commands id, hostname, uname -a, docker...

MAL-2026-13870 Malicious code in @years17/n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2 The package's postinstall script also executed on require via index.js runs a series of host reconnaissance commands id, hostname, uname -a, docker...

Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

MAL-2026-13877 Malicious code in @years17/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b The package's postinstall script executes callback.js, which runs host reconnaissance id, hostname, uname -a, directory listings, sudo -n check, dock...

Malicious code in @years17/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8 The package's postinstall script duplicated in index.js runs automatically on npm install and performs three malicious actions: 1 executes...